Login Request a demo
HA
Vendor
HashiCorp
27 products with CVEs on record
277
CVEs
0
On KEV
17
New 30D
Products
VA
Vault
HashiCorp
9.8
78 CVEs0 on KEV3 new
CO
Consul
HashiCorp
8.8
52 CVEs0 on KEV4 new
CE
Consul Enterprise
HashiCorp
8.8
17 CVEs0 on KEV4 new
VE
Vault Enterprise
HashiCorp
8.8
13 CVEs0 on KEV4 new
TO
Tooling
HashiCorp
10.0
11 CVEs0 on KEV1 new
SL
Shared library
HashiCorp
6.7
4 CVEs0 on KEV1 new
NO
Nomad
HashiCorp
9.8
41 CVEs0 on KEV0 new
GO
Go-getter
Hashicorp
9.8
9 CVEs0 on KEV0 new
VV
Vagrant Vmware Fusion
Hashicorp
8.8
7 CVEs0 on KEV0 new
BO
Boundary
HashiCorp
9.9
6 CVEs0 on KEV0 new
NE
Nomad Enterprise
HashiCorp
8.8
6 CVEs0 on KEV0 new
TE
Terraform Enterprise
HashiCorp
8.8
6 CVEs0 on KEV0 new
TE
Terraform
Hashicorp
9.8
5 CVEs0 on KEV0 new
VA
Vagrant
Hashicorp
7.8
4 CVEs0 on KEV0 new
GO
go-slug
HashiCorp
9.1
3 CVEs0 on KEV0 new
PA
Packer
HashiCorp
7.1
2 CVEs0 on KEV0 new
SE
Sentinel
Hashicorp
7.5
2 CVEs0 on KEV0 new
TP
Terraform Provider
Hashicorp
9.8
2 CVEs0 on KEV0 new
BE
Boundary Enterprise
HashiCorp
7.5
1 CVEs0 on KEV0 new
CD
Consul Docker Image
Hashicorp
9.8
1 CVEs0 on KEV0 new
CT
Consul Template
Hashicorp
7.5
1 CVEs0 on KEV0 new
HE
Hermes
Hashicorp
8.2
1 CVEs0 on KEV0 new
RE
Retryablehttp
Hashicorp
5.5
1 CVEs0 on KEV0 new
VV
Vagrant Vmware Utility
Hashicorp
3.3
1 CVEs0 on KEV0 new
VA
Vault-action
Hashicorp
7.5
1 CVEs0 on KEV0 new
VP
Vault Provider For Secrets Store Csi Driver
Hashicorp
6.5
1 CVEs0 on KEV0 new
VA
Vault-ssh-helper
Hashicorp
7.5
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-110720
New
TO
Tooling
HashiCorp
9.9
0%
Oct 26Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
CVE-2026-115804
New
CO
Consul
HashiCorp
6.4
0%
Oct 26Consul vulnerable to an authorization bypass in health check registration
CVE-2026-105626
New
CE
Consul Enterprise
HashiCorp
7.5
0%
Oct 26Consul vulnerable to a denial of service in HTTP APIs
CVE-2026-105608
New
CE
Consul Enterprise
HashiCorp
8.8
0%
Oct 26Consul vulnerable to an authorization bypass in service mesh registration
CVE-2026-105765
New
CO
Consul
HashiCorp
7.5
0%
Oct 26Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API
CVE-2026-19585
SL
Shared library
HashiCorp
5.3
0%
Oct 8Go-getter vulnerable to a path traversal in S3/GCS directory download handling
CVE-2026-89322
VA
Vault
HashiCorp
7.2
0%
Oct 7Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions
CVE-2026-105820
VE
Vault Enterprise
HashiCorp
5.4
0%
Oct 7Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution
CVE-2026-105816
VA
Vault
HashiCorp
8.0
0%
Oct 7Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots
CVE-2026-105818
VA
Vault
HashiCorp
5.9
0%
Oct 7Vault PKI ACME Issues Certificate With Unvalidated SANs
CVE-2026-88922
SL
Shared library
HashiCorp
6.7
0%
Sep 15Go-getter vulnerable to a privilege escalation issue in its archive decompression handling
CVE-2026-87993
TO
Tooling
HashiCorp
7.7
0%
Sep 10Consul-template vulnerable to an information disclosure issue in error handling
CVE-2026-88021
CO
Consul
HashiCorp
7.1
0%
Sep 10Consul vulnerable to an authorization bypass in the Connect service mesh
CVE-2026-87107
CO
Consul
HashiCorp
5.4
0%
Sep 10Consul vulnerable to an authorization bypass in the catalog deregistration path
CVE-2026-87106
CE
Consul Enterprise
HashiCorp
6.5
0%
Sep 10Consul vulnerable to a denial of service in the native RPC listener
CVE-2026-87090
CE
Consul Enterprise
HashiCorp
8.3
0%
Sep 10Consul vulnerable to an authorization bypass in the catalog node-write path
CVE-2026-5006
VA
Vault
HashiCorp
6.8
0%
Aug 24Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths
CVE-2026-14978
GO
go-slug
HashiCorp
5.5
0%
Aug 19Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions
CVE-2026-19589
PA
Packer
HashiCorp
7.1
0%
Aug 17Packer vulnerable to arbitrary file write via crafted plugin archive during installation
CVE-2026-8715
TO
Tooling
HashiCorp
9.6
0%
Aug 13Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath
CVE-2026-14886
VE
Vault Enterprise
HashiCorp
8.2
0%
Aug 10Vault Enterprise vulnerable to cross-namespace entity deletion
CVE-2026-12624
VE
Vault Enterprise
HashiCorp
4.3
0%
Aug 10Vault vulnerable to LIST authorization bypass via trailing-slash strip
CVE-2026-19113
CE
Consul Enterprise
HashiCorp
5.3
0%
Aug 7Unauthenticated denial of service via unbounded request body processing
CVE-2026-15972
CO
Consul
HashiCorp
7.5
1%
Aug 7Unauthenticated denial of service via unbounded external gRPC connection acceptance
CVE-2026-15970
CE
Consul Enterprise
HashiCorp
4.2
0%
Aug 7L7 intention authorization bypass via custom public listener
CVE-2026-19017
CE
Consul Enterprise
HashiCorp
6.8
0%
Aug 7Consul vulnerable to partial arbitrary file read via Vault Connect CA provider
CVE-2026-19015
CO
Consul
HashiCorp
5.3
0%
Aug 7Uncontrolled resource consumption in the Consul Connect CA roots endpoint
CVE-2026-19014
CO
Consul
HashiCorp
4.3
0%
Aug 7Uncontrolled resource consumption in the Consul Connect authorization endpoint
CVE-2026-19012
CO
Consul
HashiCorp
5.3
0%
Aug 7Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path
CVE-2026-19016
CE
Consul Enterprise
HashiCorp
4.2
0%
Aug 7Authorization bypass for session deletion in the transaction API
CVE-2026-16326
TO
Tooling
HashiCorp
10.0
1%
Jul 29consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
CVE-2026-16328
TO
Tooling
HashiCorp
8.6
0%
Jul 29consul-mcp-server vulnerable to server side request forgery leading to token exposure
CVE-2026-16498
TO
Tooling
HashiCorp
10.0
0%
Jul 28terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
CVE-2026-16496
TO
Tooling
HashiCorp
8.9
0%
Jul 28terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user
CVE-2026-14869
TO
Tooling
HashiCorp
8.6
0%
Jul 28terraform-mcp-server vulnerable to server side request forgery leading to token exposure
CVE-2026-14896
NE
Nomad Enterprise
HashiCorp
4.2
0%
Jul 8Nomad vulnerable to cross-namespace host volume claim deletion
CVE-2026-14361
TO
Tooling
HashiCorp
4.7
0%
Jul 8Consul-template is vulnerable to path redirection in writeToFile through symlink attack
CVE-2026-14891
NE
Nomad Enterprise
HashiCorp
8.7
0%
Jul 8Nomad vulnerable to sandbox escape in Docker task driver
CVE-2026-14373
NO
Nomad
HashiCorp
7.7
0%
Jul 8Nomad Docker driver Linux host namespace bypass
CVE-2026-14362
SL
Shared library
HashiCorp
4.9
0%
Jul 8Denial of service via crafted push/pull gossip message in memberlist
CVE-2026-14468
TE
Terraform Enterprise
HashiCorp
7.7
0%
Jul 6Path traversal allows arbitrary file read in Terraform Enterprise container
CVE-2026-5051
VE
Vault Enterprise
HashiCorp
4.4
0%
Jul 1Audit Log Plugin Directory Guard Bypass via Legacy path Option
CVE-2026-7474
NE
Nomad Enterprise
HashiCorp
8.8
8%
May 12Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution
CVE-2026-8052
SL
Shared library
HashiCorp
6.0
0%
May 12Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack
CVE-2026-6959
NO
Nomad
HashiCorp
6.0
0%
May 12Nomad vulnerable to arbitrary file read/write on client host through symlink attack
CVE-2026-5061
TO
Tooling
HashiCorp
4.7
0%
May 12Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack
CVE-2026-7776
BO
Boundary
HashiCorp
7.5
0%
May 4Boundary Workers Vulnerable to Denial of Service During TLS Handshake
CVE-2026-5807
VE
Vault Enterprise
HashiCorp
7.5
1%
Apr 17Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations
CVE-2026-4525
VE
Vault Enterprise
HashiCorp
8.8
0%
Apr 17Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header
CVE-2026-5052
VE
Vault Enterprise
HashiCorp
8.6
0%
Apr 17Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
CVE-2026-3605
VA
Vault
HashiCorp
8.1
0%
Apr 17Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service
CVE-2026-4660
TO
Tooling
HashiCorp
7.5
1%
Apr 9Go-getter may allow to arbitrary filesystem reads through git operations
CVE-2026-2808
CO
Consul
HashiCorp
6.8
0%
Mar 11Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider
CVE-2025-13432
TE
Terraform
Hashicorp
4.3
0%
Nov 21Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace
CVE-2025-13357
TP
Terraform Provider
Hashicorp
9.8
1%
Nov 21Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration
CVE-2025-11375
CO
Consul
Hashicorp
6.5
0%
Oct 28Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header
CVE-2025-11374
CO
Consul
Hashicorp
6.5
0%
Oct 28Consul and Consul Enterprise’s (“Consul”) key/value endpoint is vulnerable to denial of service (DoS) due to incorrect Content Length header validation
CVE-2025-12044
VA
Vault
Hashicorp
7.5
1%
Oct 23Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payloads
CVE-2025-11621
VA
Vault
Hashicorp
8.1
0%
Oct 23Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS…
CVE-2025-6203
VA
Vault
Hashicorp
7.5
1%
Aug 28A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU consumption of Vault